Dropbox investigating possible security breach • Hacker News Board

Re: Dropbox investigating possible security breach

#11

Post by tzs » Thu, Jul 19, 2012, 6:30 AM UTC

incongruity wrote: post #2

What I can't seem to wrap my head around is why if someone actually breached DB security that what they'd do with it is send spam . So, to me, that suggests that whatever breach might have occurred must have been minimal or via a non-critical system (i.e.: someone had an unencrypted copy of some set of users email addresses, possibly for marketing purposes, and their machine was compromised, etc.) Otherwise, it just…

Suppose the spam is specifically to get people to reason as you have you done, with the hope that it will cause a more serious leak to be overlooked?

Often, one of the best ways to hide that you've done something really bad is to let it slip that you've done something less bad, so investigators and other nosy people think they have solved the case.

This is also why, if you are using some scheme where you have an encrypted volume that is really two volumes, where one password reveals the volume that will get you sent to jail or executed, and one is the volume that is the decoy you give up after they think they have forced the password from you, you really should have something genuinely bad on the decoy. For instance have some porn that is legal but very taboo in your society, so that it makes sense for you to have protected it with strong encryption.

Re: Dropbox investigating possible security breach

#12

Post by nikcub » Thu, Jul 19, 2012, 7:34 AM UTC

incongruity wrote: post #2

What I can't seem to wrap my head around is why if someone actually breached DB security that what they'd do with it is send spam . So, to me, that suggests that whatever breach might have occurred must have been minimal or via a non-critical system (i.e.: someone had an unencrypted copy of some set of users email addresses, possibly for marketing purposes, and their machine was compromised, etc.) Otherwise, it just…

If this was a professional compromise for commercial purposes there would be no other signs than simple spam. Possible that the email addresses have been sold to one group, the passwords to another, etc. etc.

A lot of the Wordpress 0day came from guys who wanted nothing more than links back to a website. Don't underestimate what parts of the target are valuable to others, just because they aren't publically dumping databases (the linkedin database was passed around underground for a while before going public)

My biggest concern is that we are near 48 hours now and Dropbox are not able to rule out a compromise. If they had systems in place and any confidence in them they should be able to do that, not something that takes days.

Re: Dropbox investigating possible security breach

#13

Post by nikcub » Thu, Jul 19, 2012, 7:39 AM UTC

moepstar wrote: post #6

incongruity wrote: post #2

What I can't seem to wrap my head around is why if someone actually breached DB security that what they'd do with it is send spam . So, to me, that suggests that whatever breach might have occurred must have been minimal or via a non-critical system (i.e.: someone had an unencrypted copy of some set of users email addresses, possibly for marketing purposes, and their machine was compromised, etc.) Otherwise, it just…

Lets recap what i've witnessed in all of this: My Dropbox account is registered to a@gmail.com but i've received the spam to b@gmx.de which i've recently used to invite 2 people to Dropbox. So, this suggests to me that the breach has happened either on a) some external party they use for sending out the invites/emails b) their (separate) emailing servers (or servers particular for that function) have been breached Ei…

How do you use a separate email to invite people to dropbox? I am not familiar with that part of it. You seem to have hit an interesting clue

Re: Dropbox investigating possible security breach

#14

Post by moepstar » Thu, Jul 19, 2012, 9:31 AM UTC

nikcub wrote: post #13

moepstar wrote: post #6

Earlier quoted context omitted.

Lets recap what i've witnessed in all of this: My Dropbox account is registered to a@gmail.com but i've received the spam to b@gmx.de which i've recently used to invite 2 people to Dropbox. So, this suggests to me that the breach has happened either on a) some external party they use for sending out the invites/emails b) their (separate) emailing servers (or servers particular for that function) have been breached Ei…

How do you use a separate email to invite people to dropbox? I am not familiar with that part of it. You seem to have hit an interesting clue

On the iPhone it works by opening Mail.app and there you can select the outgoing email address (i've got 4 configured) and i happened to chose the one which has my clearname as for it to be recognized by the people i've sent the invite to.

(probably forgot to mention that i've used the Dropbox app on the iPhone to send out the invites)

Re: Dropbox investigating possible security breach

#15

Post by ZoFreX » Thu, Jul 19, 2012, 10:30 AM UTC

incongruity wrote: post #2

What I can't seem to wrap my head around is why if someone actually breached DB security that what they'd do with it is send spam . So, to me, that suggests that whatever breach might have occurred must have been minimal or via a non-critical system (i.e.: someone had an unencrypted copy of some set of users email addresses, possibly for marketing purposes, and their machine was compromised, etc.) Otherwise, it just…

A music website that competed with the one I worked for (and with whom we were quite chummy, hence me having some inside information) had their entire database cloned by a rogue dev who then sold it on the black market. The first sign for users that anything had gone wrong was an influx of spam to their addresses, even though the database had far more nefarious potential uses.

Re: Dropbox investigating possible security breach

#16

Post by incongruity » Thu, Jul 19, 2012, 4:19 PM UTC

ZoFreX wrote: post #15

incongruity wrote: post #2

What I can't seem to wrap my head around is why if someone actually breached DB security that what they'd do with it is send spam . So, to me, that suggests that whatever breach might have occurred must have been minimal or via a non-critical system (i.e.: someone had an unencrypted copy of some set of users email addresses, possibly for marketing purposes, and their machine was compromised, etc.) Otherwise, it just…

A music website that competed with the one I worked for (and with whom we were quite chummy, hence me having some inside information) had their entire database cloned by a rogue dev who then sold it on the black market. The first sign for users that anything had gone wrong was an influx of spam to their addresses, even though the database had far more nefarious potential uses.

Interesting... and somewhat worrisome for Dropbox.

Re: Dropbox investigating possible security breach

#17

Post by seagreen » Sat, Jul 21, 2012, 4:18 AM UTC

activepeanut wrote: post #5

nohat wrote: post #3

I recommend encfs.

Speaking of encfs, has anyone else had problems using encfs under OSX Lion? OSX would occasionally freeze on me, and when I eventually uninstalled encfs, the problem went away. It might be a coincidence tho.

Huh, I use Lion and haven't had any problems.